This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // DEBUG---------------------------------------------------------- | |
| for k, v := range c.Request.Header { | |
| log.Infof("Key: %s, Value: %s", k, v) | |
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Write-Host "Getting Login Events" | |
| $Out = @() | |
| $List = Get-EventLog Security -Computer localhost | Where-Object {$_.InstanceId -eq 4624} | |
| ForEach($Entry in $List) { | |
| If($Entry.ReplacementStrings[18] -notcontains "-"){ | |
| $Out += New-Object PSObject -Property @{ | |
| InstanceID = $Entry.InstanceId | |
| User = $Entry.ReplacementStrings[5] |
timbutler
/ gist:46e54e19efe19fea2faf
Created
November 3, 2014 00:12
Work out the most commonly called URL's in an Apache logfile
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| awk '{print $7}' access_log|cut -d? -f1|sort|uniq -c|sort -nk1|tail -n10 |
timbutler
/ fortigate50.pattern
Created
October 29, 2014 04:15
Fortigate FortiOS 5.0 Logstash Patterns
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| FORTIDATE %{YEAR:year}\-%{MONTHNUM:month}\-%{MONTHDAY:day} | |
| FORTIGATE_LITEBASE <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} eventtype=%{WORD:eventtype} level=%{WORD:level} vd=\"%{WORD:vdom}\" | |
| FORTIGATE_LITEBASE2 <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} level=%{WORD:level} vd=\"%{WORD:vdom}\" | |
| # 185 - IPS | |
| FORTIGATE_185 severity=%{WORD:severity} srcip=%{IP:srcip} dstip=%{IP:dstip} srcintf=\"%{HOST:srcintf}\" policyid=%{DATA:policyid} identidx=%{DATA:identidx} sessionid=%{NUMBER:sessionid} status=%{DATA:status} proto=%{NUMBER:proto} service=%{DATA:service} count=%{NUMBER:count} attackname=\"%{DATA:attackname}\" srcport=%{NUMBER:srcport} dstport=%{NUMBER:dstport} attackid=%{NUMBER:attackid} sensor=\"%{DATA:sensor}\" ref=\"%{DATA:ref}\";? msg=\"%{GREEDYDAT |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Postfix stuff based on https://gist.github.com/jbrownsc/4694374: | |
| QUEUEID (?:[A-F0-9]+|NOQUEUE) | |
| EMAILADDRESSPART [a-zA-Z0-9_.+-=:]+ | |
| EMAILADDRESS %{EMAILADDRESSPART:local}@%{EMAILADDRESSPART:remote} | |
| RELAY (?:%{HOSTNAME:relayhost}(?:\[%{IP:relayip}\](?::[0-9]+(.[0-9]+)?)?)?) | |
| POSREAL [0-9]+(.[0-9]+)? | |
| DELAYS (%{POSREAL}[/]*)+ | |
| DSN %{NONNEGINT}.%{NONNEGINT}.%{NONNEGINT} | |
| STATUS sent|deferred|bounced|expired |
timbutler
/ fortigate52.pattern
Last active
April 29, 2024 13:01
Fortigate FortiOS 5.2 (and 5.2.2) Logstash Grok patterns
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| FORTIDATE %{YEAR:year}\-%{MONTHNUM:month}\-%{MONTHDAY:day} | |
| FORTIGATE_52BASE <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} eventtype=%{WORD:eventtype} level=%{WORD:level} vd=\"%{WORD:vdom}\" | |
| FORTIGATE_52BASEV2 <%{NUMBER:syslog_index}>date=%{FORTIDATE:date} time=%{TIME:time} devname=%{HOST:hostname} devid=%{HOST:devid} logid=%{NUMBER:logid} type=%{WORD:type} subtype=%{WORD:subtype} level=%{WORD:level} vd=\"%{WORD:vdom}\" | |
| FORTIGATE_52IPS severity=%{WORD:severity} srcip=%{IP:srcip} dstip=%{IP:dstip} sessionid=%{NUMBER:sessionid} action=%{DATA:action} proto=%{NUMBER:proto} service=%{DATA:service} attack="%{DATA:attack}" srcport=%{NUMBER:srcport} dstport=%{NUMBER:dstport} direction=%{NUMBER:direction} attackid=%{NUMBER:attackid} profile=\"%{DATA:profile}\" ref=\"%{DATA:ref}\";? incidentserialno=%{NUMBER:incidentserialno} msg=\"%{GREEDYDATA:msg}\" | |
| FORTIGATE_52DOS severity=%{WORD:severity} s |